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© Process and apparatus for managing network event counters. 



(57) A process and apparatus for detecting the 
occurrence of an event threshold and perform- 
ing some type of action in response to the 
detection. The disclosed use of the invention is 
for managing communication connections in a 
network. An event counter, a sliding event 
threshold counter and a sliding interval counter 
are initialized to prescribed initial states at the 
start of counter management At the expiration 
of an interval specified by the contents of the 
sliding interval counter, the sliding interval 
counter is incremented by an offset time value, 
and the sliding event threshold counter is up- 
dated by the sum of an offset event value and 
the event counter. The event counter is incre- 
mented on each occurcence of an event to be 
counted. Each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, the sliding threshold event 
counter is incremented by the contents of the 
offset event value, and the sliding interval 
counter is updated to the sum of the offset time 
value and the present time. Thus, all values of 
interest are maintained by a combination of 
keeping an absolute count of the events, and by 
"sliding" the contents of two counters, one of 
which is used to measure successive time inter- 
vals and the other to set a new threshold for 
each successive interval based on the offset 
threshold and the absolute event count at the 
beginning of the interval. 
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The invention relates to event counting. In partic- 
ular, it relates to the accumulation of event informa- 
tion, such as network errors or usage information, for 
managing networks and in a way that conforms to cer- 
tain standard network specifications, such as set forth 5 
by the OSI standards. 

Network management applications often need to 
know, for a given type of event on a given connection, 
a variety of network performance items including the 
total number of events that occur during the connec- 10 
tion, the number of times that the event occurrences 
reach some threshold value (threshold crossing), how 
often this is occurring, and other information. The in- 
vention has the ability to perform these and other 
functions in a novel manner that conforms with OSI 15 
standards. 

Event counting is well known in various arts. For 
example, in the telephone switching art, it has been a 
common practice for many years to accumulate "peg" 
counts of the utilization of switching office resources 20 
as well as the number of trouble reports reported by 
the resources. Such peg counts are typically used to 
estimate the adequacy of the resources for handling 
call loads, especially during busy hour traffic. Event 
counting is also known in the computing art U.S. pa- 25 
tent 3,906,454 describes a computer monitoring sys- 
tem for detecting, filtering and storing both hardware 
and software events. The system is geared toward a 
debugging system, whereby system information can 
be gathered without interrupting the operation of the 30 
computer system, thereby avoiding a source of sys- 
tem distortion that can render test results less useful. 
Event and error counting is also common in the net- 
working art, for example to access the level of trans- 
mission quality of the various network connections 35 
between nodes and users. 

Typical known techniques for networks include 
accumulation of total error counts during a connection 
and the measuring of the duration of the connection; 
counting until a threshold is reached, irrespective of 40 
how long it takes to reach the threshold and counting 
to a threshold, thereafter followed by variations on the 
thresholds and timing intervals intended to discover 
bursty, but transient conditions, and actual degraded 
connections that should be retired. 45 

In U.S. patent 4,080,569, the occurrence of an er- 
ror triggers a timer and begins a counting interval. 
Subsequent errors occurring during the interval are 
counted until a predetermined threshold is reached or 
the timing interval expires. If the threshold is reached 50 
before expiration of the interval, an alarm is signaled 
and the timer is reset to begin a new interval. Each 
subsequent error resets the timer until a complete er- 
ror free interval occurs. 

In U.S. patent 4,241,445, a time base circuit 55 
measures recurrent intervals T2; each T2 contains an 
intermediate interval T1 . A first error counter counts 
errors up to a threshold during intervals equal at most 



to T2 and at a minimum to T1. A second error counter 
counts each threshold crossing of the first counter. 
The second counter signals an alarm when it reaches 
a predetermined value. 

In U.S. patent 4,291.403, if an error count ex- 
ceeds a predetermined threshold during an establish- 
ed time period, an alarm is generated and a second 
threshold is established to measure subsequent error 
rates. 

U.S. patent 4,339,657 establishes a variable time 
interval measured by a predetermined number of op- 
erations that occur. The arrangement counts errors 
occurring during the operations and also counts the 
number of times that the error count crosses a prede- 
termined threshold. 

U.S. patent 4,800,562 is said to provide a contin- 
uous indication of data quality in a data stream. A first 
counter counts periodic events in a data stream. A 
second counter counts errors in the data stream. 
When the first counter overflows, it recycles and also 
resets the second counter. When the second counter 
overflows, it recycles and resets the first counter. If 
the error rate is low in relation to the periodic events, 
the first counter will prevent the second counter from 
overflowing. An overflow of the second counter indi- 
cates an excessive error condition. 

Other background art is described in U.S. patents 
4,363,123 and 4,291,403. 

While the known art is satisfactory in specific in- 
stances, the art does not provide sufficient flexibility 
for today's standards. Techniques are needed that 
enable the accumulation of information that can be 
manipulated to provide a variety of measurements, 
white at the same time being efficient and simple to 
implement 

The invention is a method and apparatus for de- 
tecting the occurrence of an event threshold and per- 
forming some type of action in response to the detec- 
tion. Successive intervals of time are measured in any 
desired way. An indication is maintained of the total 
number of events that have occurred from the start of 
event monitoring. An event threshold comparison val- 
ue is established at the beginning of each interval. 
The established value is made relative to the total 
number of events that have occurred up to that point 
In response to a prescribed stimulus, a comparison is 
made between the indication of the total number of 
events that have occurred to the event comparison 
threshold value to determine if the threshold has been 
reached during the present interval. The stimulus may 
be the occurrence of an event the expiration of an in- 
terval, or other desired stimulus. 

In a preferred embodiment, an event counter, a 
sliding event threshold counter and a sliding interval 
counter are initialized to prescribed initial states at the 
start of counter management At the expiration of an 
interval specified by the contents of the sliding interval 
counter, the sliding interval counter is incremented by 
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an offset time value, and the sliding event threshold 
counter is updated by the sum of an offset event value 
and the event counter. The event counter is incre- 
mented on each occurrence of an event to be count- 
ed. Each time the event counter exceeds a threshold 
established by- the sliding threshold event counter, the 
sliding threshold event counter is incremented by the 
contents of the offset event value, and the sliding in- 
terval counter is updated to the sum of the offset time 
value and the present Lime. Thus, all values of inter- 
est are maintained by a combination of keeping an ab- 
solute count of the events, and by "sliding" the con- 
tents of two counters, one of which is used to measure 
successive time intervals and the other to set a new 
event threshold for each successive interval based on 
the offset and the absolute event count at the begin- 
ning of the interval. 

One application of the invention is in a communi- 
cations network to manage the communication con- 
nections between the network nodes and especially 
to detect degradation of a connection. Relevant infor- 
mation for managing the network is provided by each 
node periodically to a network management applica- 
tion program in the preferred embodiment 

Description of the drawing : 

Fig. 1 sets one illustrative environment for use of 
the invention. A simplified, illustrative network 
consists of two nodes and a network manage- 
ment system located somewhere in the network. 
Communication adapter cards at each node con- 
tain apparatus and/or software for accumulating 
event information on connections to which they 
are attached and communicating this information 
via their nodes to the network manager; 
Fig. 2 shows illustrative steps executed in each 
communication adapters in the preferred embodi- 
ment for periodically administering event coun- 
ters and interval counters by sliding both types of 
counters along by offsets, thereby allowing the 
accumulation of both relative and absolute values 
during a connection; 

Fig. 3 shows illustrative steps that are executed 
by a communications adapter in the preferred em- 
bodiment upon the occurrence of an event to be 
measured; and 

Fig. 4 shows, as an aid to understanding, one 
example of the occurrence of errors of a given 
type and the resulting effect of the errors on the 
sliding counters. 

Detailed description : 

Fig. 1 shows an illustrative system environment in 
which the invention might be used. The system in- 
cludes two processing nodes 100-1 and 100-2. Each 
node has a microprocessor (or other type of data proc- 



essing element) 102. The data processing element 
might consist of a desktop computer, such as a PS/2 
(Trademark) computer manufactured by International 
Business Machines, a reduced instruction set com- 

5 puter (RISC), or other general or special purpose type 
of computer. In any event, a node in this illustrative 
system includes some means for the element 102 to 
communicate with other nodes. In this illustrative em- 
bodiment, communication adapter cards 104 provide 

10 the communication interface between data process- 
ing element 102 of a node and other nodes via con- 
nections such as 108. In addition, the nodes commu- 
n icate with a network management system or applica- 
tion 106 located somewhere in the network. 

15 The purpose of the network manager 106 is to 
collect event information about the various connec- 
tions 108 in the network from the individual nodes and 
to use the information in any desired manner for the 
purpose of controlling and maintaining the network. 

20 Toward this end, the method to be described for col- 
lecting event information at each of the nodes in- 
cludes a mechanism for communicating information 
to the network manager 1 06. Typically, each node col- 
lects event information pertinent to its end of a con- 

25 nection. For example, each node may receive infor- 
mation from the other node. It is typically a node's re- 
sponsibility to collect error statistics regarding the in- 
formation it receives and to communicate the error 
statistics to the network manager 106. 

30 The illustrative embodiment of the method shown 
in Figs. 2 and 3 uses a number of variables to perform 
its functions. These variables are: 

TYPES_OF_EVENTS = the number of differ- 
ent types of events to be monitored; 

35 COUNT(I) = the number of times events of type 

I have occurred since a connection in question was 
established; 

CC(I) = a threshold event comparison value for 
this event type I; 

40 CF(I) = a predetermined offset value that is 

added to the contents of COUNT(I) to get the next 
threshold event comparison value; 

TIME = a counter that counts the number of 
units of time of granularity DELAY (seconds, minutes, 

45 etc.) that have passed since the connection was es- 
tablished; 

TC(I) the present time threshold comparison 
value for this type of event; this variable sets the per- 
iodic intervals for each event type; 

so TF(I) = the offset added to the contents of TIME 

to get the next time threshold comparison value for 
TC(I); in the illustrative embodiment, this offset is pre- 
determined for each I; 

TS(I) = a switch that indicates whether or not 

55 the network manager 1 06 should be notified when th is 
event's present measurement interval expires, i. e., 
when TIME reaches the present value contained in 
TC(I); 
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ACTION(I) = A preestablished table that con- 
tains instructions as to what type of action to perform 
at the expiration of each timing interval and at each 
event threshold crossing for each event type I. 

Figs. 2 and 3 show illustrative flowcharts of the s 
steps that are performed in the communication adap- 
ters 104 of a system to carry out the invention. When 
a connection like 108 is first established in the system, 
the steps of Fig. 2 are executed beginning at the pro- 
gram entry point INITIALIZE to begin event collection 10 
for the connection. Step 200 initializes TIME to zero 
to mark the beginning of the connection. Step 201 per- 
forms other necessary initialization functions. For 
each such type of event I, step 201 initializes vari- 
ables COUNT, TC and CC to beginning states. Spe- is 
crficaliy, for each l f COUNT is set to zero, TC is set 
equal to the interval offset TF and CC is set equal to 
CF. This means that the contents of TC that determi- 
nes the end of the first measuring interval is set equal 
to the predetermined offset in TF; the present event 20 
threshold is set equal to the offset value in CF. 

Step 202 initializes a loop based on the value of 
I. The remaining steps of Fig. 2, executed as part of 
the loop, determine when the present timing interval 
for each type of event expires and "slides" both the in- 25 
terval threshold TC and the event threshold CC for- 
ward by their respective offsets to establish a new in- 
terval and event threshold. These actions allow abso- 
lute values of interval and event counts to be main- 
tained, while at the same time allowing differential vai- 30 
ues to be used for present measuring purposes. Spe- 
cifically, step 204 decrements I to establish the next 
event type for which the present interval is checked. 
Step 206 determines if all event types have been 
processed for the present loop. If all event types have 35 
been processed, step 208 introduces a prescribed 
amount of delay in loop processing following which 
step 209 increments TIME by the DELAY amount; 
control then returns to step 202 to process the loop 
again. 40 

For each event type in the processing of one pass 
through the loop, step 210 determines if the value in 
TIME is less than the value in TC. If it is, the present 
timing interval for event I has not yet expired. In this 
case, Fig. 2 merely proceeds to the next event type at 45 
step 204. If the timing interval has expired for this 
event type I, step 212 determines from ACTION(I) 
what action should be performed and schedules the 
action. For example, the action may be to do nothing, 
or it may be to send a message to the network man- so 
ager 106 containing information also described by 
ACTION(I) so that it may track the intervals. Next, step 
214 performs the "sliding" operations described 
above to establish parameters for the next interval, cc 
is set to CF plus COUNT. This slides the event thresh- 55 
old count forward by an appropriate amount to allow 
a comparison of COUNT and CC on the occurrence 
of an event to detect an event threshold crossing dur- 



ing the next interval. The total absolute event count is 
still maintained in COUNT. TC is incremented by the 
value of its offset TF to establish the absolute time val- 
ue for ending the next interval. 

The counters TC and CC can overflow, since they 
are finite in size. Step 216 determines if an overflow 
occurred in either counter; step 218 notifies the net- 
work manager 106 of an overflow. This allows the net- 
work manager to be prepared for a shift in numbers 
on the next event message that may be received for 
this connection. Control then proceeds to INITIALIZE 
at the beginning of Fig. 2 to restart the counters. 
Otherwise, the loop beginning at step 204 is repeated 
for the next event type. 

The steps of Fig. 3 are executed each time an 
event of type J occurs on the connection in question 
(J is a particular instance of the event types I). Step 
300 immediately increments COUNT for the event 
type. Step 302 tests the new value of COUNT against 
the present threshold contained in CC. If the threshold 
is not reached, i.e., COUNT is less than CC, the rou- 
tine of Fig. 3 exits to await the next event occurrence. 
On the other hand, step 304, if the threshold is 
reached, the ACTION table is indexed by J to deter- 
mine the type of action to be performed when the 
threshold is exceeded. Typically, this might be the 
generation of a message containing parameters of in- 
terest for this type of event and the transmissio n of the 
message via microprocessor 1 02 to the network man- 
ager 1 06. A simple example of such parameters might 
be the event type J, the total number of such events 
since connection from COUNT, the time since the 
connection was established and the number of events 
J that have occurred during the present interval. On 
the other hand, depending on other information sent 
to the microprocessor, say at the expiration of each in- 
terval (Fig. 2), the microprocessor may be program- 
med to calculate some of the illustrative parameters 
just mentioned, and others. The particular details of 
parameter generation, eta are not relevant to or part 
of the invention being described. 

Following step 304, step 306 updates the CC and 
TC variables for the event type J. A new interval of 
time is begun by setting TC to the sum of TIME and 
the interval offset TF. The hew event threshold in CC 
is set to the present contents of CC plus the event off- 
set CF. Step 308 tests for an overflow of either CC(J) 
or TC(J). If there is no overflow, the program exits. 
Otherwise, step 31 0 notifies the network manager 1 06 
of the overflow so that it adjust itself accordingly; step 
312 then reinitializes the counters in the same way 
that step 201 does before the program exits. 

Fig. 4 shows one example of how the contents of 
variables and intervals vary in relation to an assumed 
set of event J occurrences. It is assumed for illustra- 
tion and for event type J that the intervals are meas- 
ured in seconds, that the interval offset in TF is set to 
60 seconds and that the event threshold offset CF is 
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set to 5. At the beginning of the interval identified as 
400, it is assumed that the total event count CC is 0, 
i.e., no events J have yet occurred on the connection. 
Therefore, COUNT equals 0 at 400 and the threshold 
count CC equals 5 (from step 214). It is further as- 
sumed that the connection has been in existence for 
3 minutes at 400. The effects of the contents of DE- 
LAY are ignored for this example, since it doesn't ma- 
terially affect the principles of operation that are being 
illustrated. Therefore, TC is set to TIME + CF = 180 + 
60 = 240 seconds at the beginning of 400. During in- 
terval 400, two events J occur as shown at 406. 
COUNT becomes equal to 2 as a result of these 
events (step 300). However, the interval threshold of 
5 is not exceeded (step 302) because COUNT (2) is 
less than CC (5). At the beginning of the next interval 
402, COUNT still equals 2 (the total number of events 
J that have occurred). CC is set to 7 (step 214) , the 
contents of COUNT plus the event offset, 5. TC be- 
comes 300, Its earlier value (240) plus the interval off- 
set 60 seconds. During interval 402, 1 more event J 
occurs at 408. COUNT becomes 3. The threshold in 
CC (now 7) is still not exceeded. At the beginning of 
interval 404, COUNT equals 3, CC is updated to 8 
(COUNT plus CF) and TC becomes 360 seconds. 
During interval 404, 5 events J are assumed to occur. 
On the fifth event at 410, COUNT becomes equal to 
8. This equals the present sliding event threshold in 
CC. Therefore, step 302 triggers a threshold crossing. 
Step 304 then takes the appropriate action to notify 
the network manager 106 of the appropriate informa- 
tion as described by ACTION. Step 306 updates CC 
and TC to begin a new interval in this preferred em- 
bodiment 



Claims 

1. In a communications network comprising a net- 
work management application program, a plural- 
ity of data processing nodes, each node further 
comprising at least one communications adapter 
interfacing the node to a connection to another 
node of the network, a method of detecting event 
thresholds executed by the communications 
adapter, said method characterized in that it com- 
prises the steps of : 

(a) measuring successive intervals of time, 

(b) maintaining an indication of the total num- 
ber of events of a prescribed type that have 
occurred on the connection, 

(c) establishing an event threshold compari- 
son value at the beginning of each interval rel- 
ative to the total number of events that have 
occurred up to that point, 

(d) in response to a prescribed stimulus, com- 
paring the indication of the total number of 
events that have occurred to the event com- 



parison threshold value to determine if the 
threshold has been reached during the inter- 
val, and 

(e) transmitting the event information to the 
5 network management application program. 

2. The method of claim 1 wherein the step of meas- 
uring successive intervals of time further compris- 
es : 

10 incrementing the contents of an interval 

timer by a prestribed amount at the expiration of 
each interval defined by the timer to define the ex- 
piration time of the next interval defined by the 
timer relative to real time. 

15 

3. The method of claims 1 or 2, wherein the step of 
maintaining an indication of the total number of 
events further comprises 

incrementing an event counter in response 
20 to each occurrence of an event, and wherein the 
prescribed stimulus is the occurrence of an event 

4. The method of claims 1, 2 or 3, wherein the step 
of establishing an event threshold further com- 

25 prises 

setting a threshold counter to the sum of 
the total event count and a predetermined offset 
value. 

30 5. The method of daims 1 to 4, further comprising 
the steps of : 

(0 activating an alert in the event a threshold 

has been reached during an interval, 

(g) updating the interval timer and the event 

35 threshold comparison value when the event 

threshold is reached, said interval timer fur- 
ther comprises a first counter and the step of 
establishing an event threshold comparison 
value for each successive interval further 

40 comprises incrementing a second counter. 

6. A method of managing event counters, compris- 
ing the steps of 

(a) incrementing the contents of an interval 
45 timer by a prescribed amount at the expiration 

of each interval defined by the timer to define 
the expiration time of the next interval defined 
by the timer relative to real time, 

(b) establishing an event threshold compari- 
so son value at the beginning of each interval rel- 
ative to the total number of events that have 
already occurred, 

(c) incrementing an event counter in response 
to the occurrence of an event, and 

55 (d) comparing the event counter to the event 

comparison threshold value to determine if the 
threshold has been reached during a present 
interval. 
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A method of managing event counters, compris- 
ing the steps of 

initializing an event counter, a sliding 
event threshold counter and a sliding interval 
counter to prescribed initial states at the start of 
counter management, 

at the expiration of an interval specified by 
the contents of the sliding interval counter, 
a) incrementing the sliding interval counter by 



relative to real time. 

1 0. The apparatus of claims 8 or 9, wherein the main- 
taining means further comprises an event coun- 
ter, means for incrementing the event counter in 
response to each occurrence of an event, and 
wherein the prescribed stimulus is the occurrence 
of an event 

11. The apparatus of claims 8 to 10, wherein the es- 
tablishing means further comprises 

- a threshold counter, 

- means for setting the threshold counter to 
the sum of the event counter and a predeter- 
mined offset vaiue. 

12. The apparatus of claims 8 to 1 1, further compris- 
ing 

- means responsive to the comparing means 
for activating an alert in the event a threshold 
has been reached during an interval. 

- means for controlling the interval timer to be- 
gin a new interval and means for updating the 
event threshold comparison value when the 
event threshold is reached, and wherein the 
interval timer further comprises a first counter 
and the establishing means further comprises 
means for. incrementing a second counter. 

13. An apparatus for managing event counters, com- 
prising 

- means for incrementing the contents of an 
interval timer by a prescribed amount at the 
expiration of each interval defined by the timer 
to define the expiration time of the next inter- 
val defined by the timer relative to real time, 

- means for establishing an event threshold 
comparison value at the beginning of each in- 
terval relative to the total number of events 
that have already occurred, 

- means for incrementing an event counter in 
response to the occurrence of an event and 

- means for comparing the event counter to 
the event comparison threshold value to de- 
termine if the threshold has been reached dur- 
ing a present interval. 



an offset time vaiue, and w 

b) updating the sliding event threshold counter 
by the sum of an offset event value and the 
event counter, 

incrementing the event counter on 
each occurrence of an event to be counted, is 
and each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, 

c) incrementing the sliding threshold event 
counter by the contents of the offset event val- 20 
ue, and 

d) updating the sliding interval counter to the 
sum of the offset time vaiue and the present 
time. 

25 

For use in a communications network comprising 
a network management application program, a 
plurality of data processing nodes, each node fur- 
ther comprising at least one communications 
adapter interfacing the node to a connection to 30 
another node of the network and containing appa- 
ratus for detecting event thresholds, said appara- 
tus further comprising 

- means for measuring successive intervals of 
time, 35 

- means for maintaining an indication of the to- 
tal number of events of a prescribed type that 
have occurred on the connection, 

- means for establishing an event threshold 
comparison value at the beginning of each in- 40 
terval relative to the total number of events 

that have occurred up to that point 

- means responsive to a prescribed stimulus 
for comparing the indication of the total num- 
ber of events that have occurred to the event 45 
comparison threshold value to determine if the 
threshold has been reached during the inter- 
val, and 

- means for transmitting the event information 

to the network management application pro- so 
gram. 

The apparatus of claim 8, wherein the measuring 
means further comprises an interval timer, means 
for incrementing the contents of the interval timer 55 
by a prescribed amount at the expiration of each 
interval defined by the timer to define the expira- 
tion time of the next interval defined by the timer 
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